On the morning of July 28, Russia’s flagship airline Aeroflot canceled dozens of domestic and international flights due to a major failure in its information systems. Preliminary reports suggest the disruption was caused by a cyberattack, which two hacker groups have claimed as a “successful, prolonged, and large-scale operation.”
Dozens of flights from Sheremetyevo canceled or delayed
Aeroflot confirmed early on Sunday that it was experiencing a technical outage affecting its digital infrastructure, warning of possible service disruptions. The airline urged passengers to monitor airport websites for updated flight information and listen for announcements at terminals.
“A team of specialists is working to minimize risks to the flight schedule and to restore services as quickly as possible,” the company said in a statement.
Due to the outage, numerous round-trip flights to and from Moscow were canceled, including routes to Astrakhan, Grozny, Yekaterinburg, Yerevan, Kaliningrad, Kazan, Mineralnye Vody, St. Petersburg, Stavropol, Sochi, and other destinations. At least seven additional flight pairs were reported delayed.
Passengers on canceled flights were advised to collect their luggage and leave Sheremetyevo Airport to avoid crowding. Refunds and rebookings for affected flights within the next 10 days are available, although the process cannot currently be done at airport counters — likely due to the same system outage.
According to most recent reports, the airline has canceled all flights for today, July 28, as it is impossible even to fuel airplanes.
Russian prosecutors begin probe into Aeroflot cyber failure
The Russian Transport Prosecutor's Office announced it is overseeing the situation, with supervisory actions underway regarding the system failure of the national carrier at Sheremetyevo Airport.
Hackers claim cyber operation against Aeroflot
Two hacker groups — Silent Crow and Cyber Partisans BY — have claimed joint responsibility for the cyberattack. In a public statement, Silent Crow said:
“Together with our colleagues from Cyber Partisans BY, we announce the successful completion of a prolonged and large-scale operation which resulted in the total compromise and destruction of Aeroflot’s internal IT infrastructure.”
The hackers claimed they had infiltrated Aeroflot’s internal corporate network for over a year, gaining access to databases, flight records, employee computers, and surveillance server data.
They further alleged that they had destroyed approximately 7,000 physical and virtual servers, branding the attack as “a direct message to the FSB, NCCCI, RT-Solar, and other so-called ‘cyber defenders’.” Their publication ended with a pro-Ukrainian slogan.
